Encryption in transit & at rest
All data encrypted with TLS 1.3 in transit and AES-256 at rest in Supabase Postgres.
Security at ASHR.work
Your people's data is the most sensitive data your business owns. We design ASHR.work to treat it that way — by default, not by checklist.
Row-level security (RLS)
Tenant data is protected by Postgres row-level security policies — your organisation’s records are isolated from every other organisation, and employees only see what their role allows.
Role-based access control
Admin, Manager and Employee roles enforced both in the UI and database.
Audit logging
Sensitive actions are logged for compliance review and incident response.
Reliable infrastructure
Hosted on Vercel and Supabase, with your data stored in Mumbai, India. Our availability targets, and how we are measuring against them, are published on the status page.
GDPR, CCPA & DPDP aligned
Data subject rights, consent and retention workflows designed around EU GDPR, US CCPA, UK GDPR and India DPDP.
Questions about our security posture?
We're happy to answer vendor-security questionnaires.